connect
connect copied to clipboard
authorizedScope, allow for no role scopes
not allowing for this case can cause a crash
@ikb42 can you describe what's happening in a little more detail? I'm not sure I understand "no role scopes". We're handling these "unassigned" scopes in Scope.determine() method:
https://github.com/anvilresearch/connect/blob/master/models/Scope.js#L46-L85
In the case that the subject client has been assigned a role but the role has no permitted scopes.
If this subject and a scope is then passed to Scope.determine, then subject.authorizedScope will return [ undefined ] which will then crash in Scope.determine on line found = found || (result.indexOf(scope.name) !== -1).